Designing and Managing Behavior Models - Getting Started with NerveCenter Client - Setting Up Alarm-Instance Filters - Rules for Associating Filters with Alarms -
Previous: Associating a Filter with a Server     Next: Specifying Heartbeat Messaging

Rules for Associating Filters with Alarms

When deciding whether to apply multiple filters to your alarms, you should keep in mind the following general rules:

• Multiple filters are ORed together
• Multiple conditions in a single filter are ANDed together

Multiple Filters are ORed Together

When you select more than one filter for a server, each filter is independent of the other filters. Their behavior is equivalent to a logical OR operation.

For example, say you associate two filters with a NerveCenter Server. The two filters are defined as follows:

• Filter #1 is configured to display only those alarms that have a severity level of Critical.
• Filter #2 is configured to display only those alarms coming from the network 132.168.196.0.

When both filters are applied to a server, you see the following alarms:

• Alarms with a Critical severity level from all existing networks defined for the server.
• From the network 132.168.196.0, you see all alarms regardless of severity.

Multiple Conditions in a Single Filter are ANDed Together

If, instead of the above view, you want to limit your alarms to Critical instances coming from the network 132.168.196.0, you need to create one filter with both of those conditions. You would create one filter that:

• Specifies a severity level of Critical, and
• Specifies an IP range of 132.168.196.0.

With this filter applied to the server, you see only those alarms that have a Critical severity level and that come from network 132.168.196.0. One filter with multiple conditions is equivalent to a logical AND operation; each condition is ANDed with the other conditions for optimum filtering.